GRC Analyst
- Location
- Remote, Global
- Work mode
- Remote
- Employment type
- Full-time
About the job
ABOUT THE ROLE
We’re looking for a GRC Analyst to join our Compliance & Security team and help make risk management, audit and compliance a continuous part of how Supabase runs. You’ll work closely with engineering, security, IT, and legal to help us define our risk tolerance, keep our compliance programs (including SOC 2 and ISO/IEC 27001:2022) current, test controls on a rolling basis, and answer customer and vendor security reviews quickly and accurately.
This role is ideal for someone who thrives in async, fast-paced environments and is excited about building developer tools that scale to millions.
WHAT YOU’LL BE RESPONSIBLE FOR
- Run risk assessments across the company and major product changes. Score likelihood and impact, propose treatments, and bring the results to leadership to inform risk tolerance decisions.
- Maintain the risk register, track remediation to closure, and report status to compliance and security leadership.
- Monitor controls on a rolling basis, using automated tests where they exist and manual testing where they don’t. Triage failures, prioritize by the risk register, and align each finding with an owner and a due date.
- Support internal audit, whether performed by an external partner or in-house: propose scope from the risk register, supply evidence, and track findings to closure.
- Run day-to-day operations for our compliance programs: evidence collection, control owner follow-up, and readiness ahead of each audit period.
- Extend continuous control validation beyond what our compliance platform covers. Build custom tests with AI coding tools, work with engineering and IT to pull evidence from source systems instead of collecting screenshots, and check that each test proves what the control requires.
YOU MIGHT BE A GOOD FIT IF YOU
- Have 3+ years of experience in GRC, internal audit, or security compliance at a SaaS or technology company
- Are comfortable working with SOC 2 and ISO 27001 controls, a compliance platform such as Drata, Vanta, and evidence from systems like AWS, GCP, Google Workspace, and Okta
- Communicate clearly across both technical and non-technical audiences
- Have experience in async or globally distributed teams
- Are energized by solving real-world problems for developers
- Are comfortable navigating ambiguity and moving quickly
WHAT WE OFFER
- Fully Remote
- Fully Remote
- ESOP
- ESOP
- Tech Allowance
- Tech Allowance
- Health Benefits
- Health Benefits
- Annual Off-Sites
- Annual Off-Sites
- Flexible Work
- Flexible Work
- Professional Development
- Professional Development
ABOUT THE TEAM
Supabase was born-remote and open-source-first. We believe our globally distributed team is our secret weapon in building tools developers love.
- ~400 team members
- 60+ countries
- 20+ languages spoken
- Over $1B raised (including our $500M Series F)
- 540,000+ community members
We move fast, build in public, and use what we ship. If it’s in your project, we probably use it in ours too. We believe deeply in the open-source ecosystem and strive to support—not replace—existing tools and communities.
From Supabase's careers page (Ashby), checked 29 Oct 2026.
How to apply
- Select Apply on supabase.com. It opens Supabase's own application form in a new tab, run on Ashby.
- Fill in the form and upload your résumé there. Jobiwork never sees your application.
- Supabase will reply to you directly. No real employer asks you for money to apply.
Posted 21 Oct 2026 · checked 29 Oct 2026 · Report this job